by 安全扫描
OpenClaw
可疑
high confidenceThe skill appears to do what its name says (fetch Douyin hot lists, analyze, produce a .docx and email it) but its runtime instructions and bundled code expect several secrets, APIs, and persistent system changes that are not declared in the registry metadata — source-of-truth mismatches that warrant caution.
评估建议
Key things to consider before installing: (1) This skill will ask you to provide and store multiple sensitive credentials (email SMTP credentials, TikHub token, and transcription API keys) but the registry metadata does not declare them — treat that as a red flag. (2) The provided setup script will create a Python venv, pip-install packages, write a .env, add cron jobs and may write to ~/.openclaw/config.json; review the setup script line-by-line before running, and do not run it as root on a pr...详细分析 ▾
ℹ 用途与能力
The code and dependencies (hot-trend fetcher, video downloader, transcription/MCP server, analysis pipeline, email sender) are consistent with producing an automated Douyin daily report. However the registry metadata claims no required env vars/configs, yet the skill clearly needs SMTP credentials, a TikHub token, and third-party transcription API keys — a mismatch between declared requirements and actual capabilities.
⚠ 指令范围
SKILL.md instructs the agent to create .env, write/read ~/.openclaw/config.json (TikHub token), run a root-path setup script (/root/.openclaw/...), and install cron jobs. The runtime instructions reference local file paths and config files that were not declared in the skill metadata and grant the skill broad discretion to create scheduled tasks and write to platform config — more scope than the registry claims.
ℹ 安装机制
There is no formal install spec in the registry (the skill is treated as instruction-only) but the package contains many scripts (setup_douyin_daily_report.sh, run_daily_digest.py, MCP server code) that will create virtualenvs, pip-install dependencies, and configure cron. The bundled code itself is local (no suspicious arbitrary download URLs), but running the included setup script will perform system changes; lack of an explicit registry install step is misleading.
⚠ 凭证需求
Registry shows 'no required env vars' yet SKILL.md and code require/expect: SMTP_USER/SMTP_PASS/SMTP_HOST/SMTP_PORT (email sending), DOUYIN_EMAIL_RECIPIENTS, TikHub token stored in ~/.openclaw/config.json, and various transcription API keys (API_KEY / DOUYIN_API_KEY / dashscope/siliconflow keys). Those are sensitive credentials unrelated to the registry declaration and are proportionally significant for a 'report' skill.
⚠ 持久化与权限
The setup script configures cron jobs (scheduled execution at 08:00 and 16:00) and SKILL.md instructs writing tokens into ~/.openclaw/config.json — both are persistent changes outside the skill directory. The codebase also includes an MCP server and WebUI components which could run as a local service. While always:false, the skill requests persistent scheduling and config writes without declaring that level of privilege.
⚠ dependencies/douyin-hot-trend/cron-job.js:16
Shell command execution detected (child_process).
⚠ dependencies/douyin-hot-trend/scripts/get-hot-trend.js:16
Shell command execution detected (child_process).
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/4/14
- Updated the default value of the DOUYIN_EMAIL_RECIPIENTS environment variable to be empty in documentation. - No other user-facing or functional changes detected in this version.
● 可疑
安装命令 点击复制
官方npx clawhub@latest install douyin-analyse-batch
镜像加速npx clawhub@latest install douyin-analyse-batch --registry https://cn.clawhub-mirror.com
技能文档
全自动抖音视频分析邮件推送系统。每天定时（08:00、16:00）获取抖音热榜 TOP15，对每个视频调用 OpenClaw 内置模型（MiniMax-M2.7）生成结构化分析笔记，输出 Word 文档并邮件推送。
安装即用
本 skill 已包含所有依赖，无需单独安装其他 skills。安装后运行一键部署：
bash /root/.openclaw/workspace/skills/douyin-daily-report/scripts/setup_douyin_daily_report.sh
该脚本自动完成：
- 创建 Python 虚拟环境（faster-whisper / yt-dlp / python-docx / requests）
- 生成
.env环境变量文件 - 检查 TikHub API Token
- 设置 Cron 定时任务（每天 08:00 和 16:00）
环境变量配置
编辑 .env 文件：
SMTP_USER=your_email@qq.com
SMTP_PASS=QQ邮箱SMTP授权码
SMTP_HOST=smtp.qq.com
SMTP_PORT=587
DOUYIN_EMAIL_RECIPIENTS=
DOUYIN_DIGEST_LIMIT=15
TikHub Token 写入 ~/.openclaw/config.json：
{"tikhub_api_token": "tk_live_xxxxxxxx"}
手动运行
# 发送邮件
bash /root/.openclaw/workspace/skills/douyin-daily-report/scripts/cron_daily_digest_wrapper.sh# 指定条数，不发邮件（测试用）
SMTP_USER=xxx SMTP_PASS=xxx DOUYIN_EMAIL_RECIPIENTS=xxx \
/usr/bin/python3 /root/.openclaw/workspace/skills/douyin-daily-report/scripts/run_daily_digest.py \
--limit 15 --skip-transcribe --no-email
完整链路
TikHub 热榜 API
↓ fetch_hot_total_video_list
OpenClaw LLM（MiniMax-M2.7）
↓ title + tags → 分析笔记
MD 文件写入
↓
md_to_docx.py（python-docx）
↓
EmailMessage（RFC 5987 编码）
↓ SMTP → QQ 邮箱
只发 .docx 附件
输出内容
每条视频：播放量、点赞量、作者、链接、LLM 分析笔记（钩子、核心主张、论据支撑、批判性分析）
故障排查
- 邮件显示 .bin：已修复，使用 EmailMessage RFC 5987 编码
- LLM 分析失败：确认 OpenClaw Gateway 运行中
- TikHub 失败：确认
~/.openclaw/config.json中tikhub_api_token正确 - 日报少于15条：TikHub 免费热榜每日返回数据量不固定
文件结构
douyin-daily-report/
├── SKILL.md
├── .env ← 环境变量（setup 脚本生成）
├── scripts/
│ ├── setup_douyin_daily_report.sh ← 一键安装（含 venv + Cron）
│ ├── cron_daily_digest_wrapper.sh ← Cron 入口
│ ├── run_daily_digest.py ← 核心流水线
│ └── helpers/
│ ├── send_email.py ← 邮件发送
│ └── md_to_docx.py ← MD→Word
└── dependencies/ ← 完整依赖 skills
├── douyin-video-analysis/
├── douyin-hot-trend/
└── douyin-mcp-server/
卸载
# 删除 Cron
crontab -l | grep -v "douyin_daily_digest" | crontab -# 删除虚拟环境和输出
rm -rf /tmp/douyin_transcribe
rm -rf ~/Documents/douyin_analysis
# 删除 skill 目录
rm -rf /root/.openclaw/workspace/skills/douyin-daily-report
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制